Text to be removed highlighted in red.
1 Short title. This subdivision shall be known as "The Digital Choice Act."
2 New Subdivision; Digital Choice. Amend RSA 358-A by inserting after section 13 the following new subdivision:
Digital Choice
358-A:14 Definitions. As used in this subdivision:
I. "Open protocol" means a publicly available technical standard that:
(a) Enables interoperability and data exchange between social media services through a shared data layer;
(b) Is free from:
(1) Licensing fees; and
(2) Patent restrictions; and
(c) Governs how social media services communicate and exchange data with each other.
II. "Personal data" means any information that is linked or reasonably linkable to an identified or identifiable individual, including social graphs.
III.(a) "Social graph" means data that represents a person's connections and interactions within a social media service.
(b) "Social graph" includes:
(1) Content generated by the person;
(2) The person's social connections with other users and entities;
(3) The person's responses to other users' and entities' content, including comments, reactions, mentions, reposts, shares, and other engagements;
(4) The person's public profile; and
(5) Metadata associated with items in subparagraphs (1) through (4) of this paragraph.
(6) Relational references sufficient to maintain the associations among data elements described in subparagraphs (1) through (4) of this paragraph.
(c) "Social graph" does not include other users' and entities' content and responses that have been designated private by those users and entities, including private messages.
IV. "Social media company" means an entity that owns or operates a social media service.
V.(a) "Social media service" means a public website or application that:
(1) Displays content that is primarily generated by account holders and not by the social media company;
(2) Permits an individual to register as an account holder and create a profile that is made visible to the general public or a set of other users defined by the account holder;
(3) Connects account holders to allow users to interact socially with each other within the website or application; and
(4) Allows account holders to post content viewable by other users.
(b) "Social media service" does not include:
(1) Email;
(2) Cloud storage; or
(3) Document viewing, sharing, or collaboration services.
VI. "User" means an individual who is a resident of this state who accesses or uses a social media service.
358-A:15 Legislative Findings. The following is hereby found and declared:
I. An individual has a right to control and move the individual's own personal data, including social interactions online;
II. Companies have demonstrated a pattern of restricting the interoperability of content, preventing users from easily sharing posts and interactions across different platforms.
III. The state should ensure that individuals have the right to access a complete personal data record from social media platforms.
358-A:16 Data Rights.
I. ?A user shall have the right to:
(a) Delete personal data held by the social media company that was provided by, or obtained about, the user;?and
(b) Obtain a copy of the user's personal data processed by the social media company, in a portable and, to the extent technically feasible, readily usable format that allows the user to transmit the data to another user without hindrance, where the processing is carried out by automated means, provided such user shall not be required to reveal any trade secret.
II. ?A user may exercise rights under this section by a secure, timely, and reliable means established by the secretary of state. ?
358-A:17 Data Interoperability Requirements.
I. A social media company shall implement a transparent, third-party-accessible interoperability interface or interfaces to allow users to choose to:
(a) Share a common set of their current social graph or user-selected parts of their social graph between the social media services they designate; and
(b) Enable third parties to access social graph data they create and be notified when new or updated social graph data is available, with the user's permission.
II. A social media company that receives personal data shall reasonably secure any personal data it acquires.
III. In order to achieve interoperability under paragraph I, a social media company shall:
(a) Utilize an open protocol;
(b) Facilitate and maintain interoperability and continuous, real-time data sharing with other social media services through an interoperability interface, based on reasonable terms that do not discriminate between social media services;
(c) Establish reasonable and proportionate thresholds related to the frequency, nature, and volume of requests, beyond which the social media company may assess a reasonable fee for such access; and
(d) Disclose to other social media companies complete, accurate, and regularly updated documentation describing access to the interoperability interface required under this section.
IV. A social media company or third party may not collect, use, or share personal data obtained from other social media services through the interoperability interface except for the purposes of safeguarding the privacy and security of such information or maintaining interoperability of services.
V. A social media company or third party may not share or receive personal data through the interoperability interface except with the user's consent.
VI. A social media company shall adopt an accessible, prominent, and persistent method for users to give consent for data sharing with other social media services or third parties through the interoperability interface and shall promptly implement the user's instructions.
VII. A social media company is not required to:
(a) Provide access to:
(1) Inferences, analyses, or derived data that the social media company has generated internally about a user; or
(2) Trade secrets, proprietary algorithms, ranking systems, or other internal operating mechanisms; or
(b) Transmit data that meets all of the following criteria:
(1) Such data is stored or structured in a proprietary format;
(2) No open, industry-standard format is reasonably available; and
(3) Transmitting the data would disclose information described in paragraph (a) of this subdivision.
358-A:18 Rulemaking Authority.
I. The attorney general may, after completing an assessment, adopt rules, pursuant to RSA 541-A,?to identify open protocols that it has determined meet the requirements of RSA 358-A:17.
II. A social media company that utilizes an open protocol identified by the attorney general under this section shall be entitled to a rebuttable presumption of providing access on reasonable terms that do not discriminate between social media services.
358-A:19 Enforcement.
I. The attorney general shall have exclusive authority to enforce violations under this subdivision.
II. Nothing in this subdivision shall be construed as providing the basis for, or be subject to, a private right of action for violations under this subdivision or any other law.
III. A violation under this subdivision shall constitute an unfair method of competition or any unfair or deceptive act or practice in the conduct of any trade or commerce within this state under RSA 358-A:2 and shall be enforced by the attorney general.
358-A:20 Severability. The provisions of this subdivision are severable. If any provision of this subdivision or its application is held invalid, that invalidity shall not affect other provisions or applications that can be given effect without the invalid provision or application.
3 Effective Date. This act shall take effect 90 days after its passage.
Text to be added highlighted in green.
1 Short title. This subdivision shall be known as "The Digital Choice Act."
2 New Subdivision; Digital Choice. Amend RSA 358-A by inserting after section 13 the following new subdivision:
Digital Choice
358-A:14 Definitions. As used in this subdivision:
I. "Open protocol" means a publicly available technical standard that:
(a) Enables interoperability and data exchange between social media services through a shared data layer;
(b) Is free from:
(1) Licensing fees; and
(2) Patent restrictions; and
(c) Governs how social media services communicate and exchange data with each other.
II. "Personal data" means any information that is linked or reasonably linkable to an identified or identifiable individual, including social graphs.
III.(a) "Social graph" means data that represents a person's connections and interactions within a social media service.
(b) "Social graph" includes:
(1) Content generated by the person;
(2) The person's social connections with other users and entities;
(3) The person's responses to other users' and entities' content, including comments, reactions, mentions, reposts, shares, and other engagements;
(4) The person's public profile; and
(5) Metadata associated with items in subparagraphs (1) through (4) of this paragraph.
(6) Relational references sufficient to maintain the associations among data elements described in subparagraphs (1) through (4) of this paragraph.
(c) "Social graph" does not include other users' and entities' content and responses that have been designated private by those users and entities, including private messages.
IV. "Social media company" means an entity that owns or operates a social media service.
V.(a) "Social media service" means a public website or application that:
(1) Displays content that is primarily generated by account holders and not by the social media company;
(2) Permits an individual to register as an account holder and create a profile that is made visible to the general public or a set of other users defined by the account holder;
(3) Connects account holders to allow users to interact socially with each other within the website or application; and
(4) Allows account holders to post content viewable by other users.
(b) "Social media service" does not include:
(1) Email;
(2) Cloud storage; or
(3) Document viewing, sharing, or collaboration services.
VI. "User" means an individual who is a resident of this state who accesses or uses a social media service.
358-A:15 Legislative Findings. The following is hereby found and declared:
I. An individual has a right to control and move the individual's own personal data, including social interactions online;
II. Companies have demonstrated a pattern of restricting the interoperability of content, preventing users from easily sharing posts and interactions across different platforms.
III. The state should ensure that individuals have the right to access a complete personal data record from social media platforms.
358-A:16 Data Rights.
I. ?A user shall have the right to:
(a) Delete personal data held by the social media company that was provided by, or obtained about, the user;?and
(b) Obtain a copy of the user's personal data processed by the social media company, in a portable and, to the extent technically feasible, readily usable format that allows the user to transmit the data to another user without hindrance, where the processing is carried out by automated means, provided such user shall not be required to reveal any trade secret.
II. ?A user may exercise rights under this section by a secure, timely, and reliable means established by the secretary of state. ?
358-A:17 Data Interoperability Requirements.
I. A social media company shall implement a transparent, third-party-accessible interoperability interface or interfaces to allow users to choose to:
(a) Share a common set of their current social graph or user-selected parts of their social graph between the social media services they designate; and
(b) Enable third parties to access social graph data they create and be notified when new or updated social graph data is available, with the user's permission.
II. A social media company that receives personal data shall reasonably secure any personal data it acquires.
III. In order to achieve interoperability under paragraph I, a social media company shall:
(a) Utilize an open protocol;
(b) Facilitate and maintain interoperability and continuous, real-time data sharing with other social media services through an interoperability interface, based on reasonable terms that do not discriminate between social media services;
(c) Establish reasonable and proportionate thresholds related to the frequency, nature, and volume of requests, beyond which the social media company may assess a reasonable fee for such access; and
(d) Disclose to other social media companies complete, accurate, and regularly updated documentation describing access to the interoperability interface required under this section.
IV. A social media company or third party may not collect, use, or share personal data obtained from other social media services through the interoperability interface except for the purposes of safeguarding the privacy and security of such information or maintaining interoperability of services.
V. A social media company or third party may not share or receive personal data through the interoperability interface except with the user's consent.
VI. A social media company shall adopt an accessible, prominent, and persistent method for users to give consent for data sharing with other social media services or third parties through the interoperability interface and shall promptly implement the user's instructions.
VII. A social media company is not required to:
(a) Provide access to:
(1) Inferences, analyses, or derived data that the social media company has generated internally about a user; or
(2) Trade secrets, proprietary algorithms, ranking systems, or other internal operating mechanisms; or
(b) Transmit data that meets all of the following criteria:
(1) Such data is stored or structured in a proprietary format;
(2) No open, industry-standard format is reasonably available; and
(3) Transmitting the data would disclose information described in paragraph (a) of this subdivision.
358-A:18 Rulemaking Authority.
I. The attorney general may, after completing an assessment, adopt rules, pursuant to RSA 541-A,?to identify open protocols that it has determined meet the requirements of RSA 358-A:17.
II. A social media company that utilizes an open protocol identified by the attorney general under this section shall be entitled to a rebuttable presumption of providing access on reasonable terms that do not discriminate between social media services.
358-A:19 Enforcement.
I. The attorney general shall have exclusive authority to enforce violations under this subdivision.
II. Nothing in this subdivision shall be construed as providing the basis for, or be subject to, a private right of action for violations under this subdivision or any other law.
III. A violation under this subdivision shall constitute an unfair method of competition or any unfair or deceptive act or practice in the conduct of any trade or commerce within this state under RSA 358-A:2 and shall be enforced by the attorney general.
358-A:20 Severability. The provisions of this subdivision are severable. If any provision of this subdivision or its application is held invalid, that invalidity shall not affect other provisions or applications that can be given effect without the invalid provision or application.
3 Effective Date. This act shall take effect 90 days after its passage.